Data protection

Your rights as a data subject

The General Data Protection Regulation of the EU provides you, as the data subject, with various rights regarding our processing of your personal data. You can exercise these rights in different ways depending on the basis of processing the personal data.

Right of access and inspection

You have the right to know if we process your personal data and which data about you we process.

You have the right to receive your own data free of charge. However, if you request several copies, we may charge a reasonable fee based on the administrative costs.

Right of rectification

You have the right to request that we rectify any inaccurate or erroneous personal data about you or complement incomplete data.

Right of removal, right to be forgotten

In some exceptional cases, e.g. if the processing of data is based on consent and you withdraw your consent, you have the right to have your data removed, i.e. to be forgotten.

Right to restrict processing

In some cases, you may have the right to request that the processing of your personal data be restricted while your data has been reviewed and rectified or completed appropriately. You denying the accuracy of your data may be such a case.

Right to transfer data from one system to another

You have the right to transfer your personal data from one data controller to another if you have submitted the data to us personally and the processing of data is based on consent or an agreement and the processing is automated.

Right of objection

You have the right to object to the processing of your personal data based on your personal special situation if the processing is based on carrying out a task in the public interest or in the exercise of official authority. In this case, the processing may only continue if there is a significantly important and justified basis for the processing that we can verify. Processing may also continue if processing is necessary to prepare, present or defend a legal claim.

Right to contest an individual automatic decision

You have the right to not be subjected to such a decision based on automated personal data processing that has legal repercussions or other similarly significant consequences for you. Automated decision-making refers to a process where a human is not involved in the decision-making, but the decision is made through automation based on the personal data.

Metropolitan Area Transport Ltd does not use automated processing of personal data to make such decisions.

How to exercise your rights

You can submit requests regarding your personal data by email to or by post to the address Data Protection – Administrative Services, PO Box 100 (Hämeentie 86), FI-01022 CITY TRANSPORT. Please state in your request which rights you wish to exercise and also, when possible, which of our registers your request concerns. You can find a list of our registers and their descriptions on this page.

We will respond to all requests about personal data as soon as possible and within a month from receiving the request, at the latest. If the request is especially complicated, we may need to prolong the processing time by two months, at the maximum. We will always inform you of the prolonged processing time and the reasons for the prolongation within a month from receiving the request.

Right to lodge a complaint with authorities

You have the right to lodge a complaint with the data protection authorities if you suspect your personal data is being processed in a way that goes against the data protection legislation. In Finland, such an authority is the Data Protection Ombudsman.

The contact information of the Office of the Data Protection Ombudsman:
Street address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: PO Box 800, FI-00531 Helsinki
Email: tietosuoja(at)
Switchboard: +358 29 566 6700
Registry: +358 29 566 6768